Description

PHP 8.2.31+ and 8.3.31+ no longer compile against OpenSSL 1.0.2, though both branches still accept it (ext/openssl/config0.m4: "requires OpenSSL >= 1.0.2").

To reproduce, build PHP 8.3.36 (or any 8.3.31+ or 8.2.31+) --with-openssl against OpenSSL 1.0.2, e.g. on CentOS 7 (OpenSSL 1.0.2k, gcc 4.8.5).

Resulted in this output:

ext/openssl/xp_ssl.c: In function 'php_openssl_matches_san_list':
ext/openssl/xp_ssl.c:506:6: warning: implicit declaration of function 'ASN1_STRING_get0_data' [-Wimplicit-function-declaration]
      ASN1_STRING_get0_data(san->d.iPAddress)[0],
      ^
ext/openssl/xp_ssl.c:506:45: error: subscripted value is neither array nor pointer nor vector
      ASN1_STRING_get0_data(san->d.iPAddress)[0],
                                             ^
ext/openssl/xp_ssl.c:507:45: error: subscripted value is neither array nor pointer nor vector
ext/openssl/xp_ssl.c:508:45: error: subscripted value is neither array nor pointer nor vector
ext/openssl/xp_ssl.c:509:45: error: subscripted value is neither array nor pointer nor vector
ext/openssl/xp_ssl.c:138:10: error: subscripted value is neither array nor pointer nor vector
    _bytes[0] << 8 | _bytes[1], \

But I expected the build to succeed, as it does with 8.3.30 / 8.2.30 against the same OpenSSL.

Cause: 19255f4 ("Backport compatibility changes for OpenSSL 4.0") changed the IP SAN code in php_openssl_matches_san_list() from san->d.iPAddress->data to ASN1_STRING_get0_data(san->d.iPAddress). ASN1_STRING_get0_data() was added in OpenSSL 1.1.0. ext/openssl/openssl.c already defines a fallback for it under #if PHP_OPENSSL_API_VERSION < 0x10100 (return M_ASN1_STRING_data(asn1);), but that is static to openssl.c, and xp_ssl.c has no equivalent. (ASN1_STRING_length(), used in the same change, does exist in 1.0.2.) PHP-8.2 and PHP-8.3 HEAD are both still affected. 8.4+ requires OpenSSL >= 1.1.1, so it is not.

Suggested fix: the same fallback in xp_ssl.c, under the same guard (it compiles away on 1.1.0+):

--- a/ext/openssl/xp_ssl.c
+++ b/ext/openssl/xp_ssl.c
@@ -36,6 +36,10 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
+#if PHP_OPENSSL_API_VERSION < 0x10100
+# define ASN1_STRING_get0_data(asn1) ((const unsigned char *)M_ASN1_STRING_data(asn1))
+#endif
+
 #ifdef PHP_WIN32
 #include "win32/winutil.h"
 #include "win32/time.h"

With that applied, 8.3.36 builds on CentOS 7 against OpenSSL 1.0.2k. A verified TLS connection to a server whose certificate's only SAN is IP:127.0.0.1 succeeds, and the same connection with a peer_name the certificate doesn't cover is refused, so the IP SAN matching works. Alternatively, the fallback could move to php_openssl.h so both files share it.

PHP Version

PHP 8.3.36 (fails to build against OpenSSL 1.0.2; first affected: 8.3.31 and 8.2.31)

Operating System

CentOS 7 (OpenSSL 1.0.2k)